FortiManager flaw lets admin users gain root over HTTP
Original title: Authorization bypass through user-controlled key
The CVSS 8.2 issue requires an authenticated administrator; Fortinet does not list versions or a fix.
Fortinet PSIRT says FortiManager has an authorization bypass through a user-controlled key (CWE-639), tracked as FG-IR-26-235. A remote authenticated attacker who already has admin permission may elevate privileges to root with crafted HTTP requests. The advisory was revised on November 10, 2026.
Unconfirmed: Affected versions, a fix, and exploitation status are not stated.
- CVSSv3 score is 8.2.
- The attacker must already be an authenticated administrator.
- Privilege gain is to root through crafted HTTP requests.
- Advisory FG-IR-26-235 was revised on November 10, 2026.
Impact: Privilege escalation from admin to root
| Product | Affected |
|---|---|
| Fortinet FortiManager | — |
- Vendors
- Fortinet
- Products
- FortiManager
From the original article
CVSSv3 Score: 8. 2 An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] in FortiManager may allow a remote authenticated attacker with admin permission to elevate their privileges to root via crafted HTTP requests. Revised on 2026-11-10 00:00:00
fortiguard.fortinet.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.